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National Passenger Railroad Corporation 

10 G Street, NE 

Washington, D.C. 20002 

Dear Ms. Green: 

We have reviewed the system of quality control for the audit function of National 
Passenger Railroad Corporation's (Amtrak) Office of Inspector General (OIG) in 
effect for the year ended September 30, 2008. Amtrak OIG's system of quality 
control encompasses its organizational structure and the policies adopted and 
procedures established to provide it with reasonable assurance of conforming 
with Government Auditing Standards. The elements of quality control are 
described in Government Auditing Standards. Amtrak OIG is responsible for 
designing a system of quality control and complying with it to provide Amtrak OIG 
with reasonable assurance of performing and reporting in conformity with 
applicable professional standards in all material respects. Our responsibility is to 
express an opinion on the design of the system of quality control and Amtrak 
OIG's compliance with that system based on our review. 

Our review was conducted in accordance with Government Auditing Standards 
and guidelines established by the President's Council on integrity and Efficiency 
(PCIE) and the Executive Council on Integrity and Efficiency (ECIE) 1 . During our 
review, we interviewed Amtrak OIG personnel and obtained an understanding of 
the nature of the Amtrak OIG audit function, and the design of the Amtrak OIG's 
system of quality control sufficient to assess the risks implicit in its audit function. 
Based on our assessments, we selected audits and administrative files to test for 
conformity with professional standards and compliance with the Amtrak OIG's 
system of quality control. The audits selected represented a reasonable cross- 
section of the Amtrak OIG's audit function. Prior to concluding the review, we 
met with Amtrak OIG management to discuss the results of our review. We 



1 As part of the Inspector General Reform Act of 2008, the PCIE and ECIE were merged and became the 
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believe that the procedures we performed provide a reasonable basis for our 
opinion. 

!n performing our review, we obtained an understanding of the system of quality 
control for the Amtrak OIG's audit function. In addition, we tested compliance 
with the Amtrak OIG's quality control policies and procedures to the extent we 
considered appropriate. These tests covered the application of the Amtrak OiG's 
policies and procedures on selected audits. Our review was based on selected 
tests; therefore, it would not necessarily detect al! weaknesses in the system of 
quality control or all instances of noncompliance with it. 

There are inherent limitations in the effectiveness of any system of quality control 
and therefore noncompliance with the system of quality control may occur and 
not be detected. Projection of any evaluation of a system of quality control to 
future periods is subject to the risk that the system of quality control may become 
inadequate because of changes in conditions, or because the degree of 
compliance with the policies or procedures may deteriorate. Attachment 1 to this 
report identifies the offices of the Amtrak OiG that we visited and the audits that 
we reviewed. 

In our opinion, except for the deficiencies described below, the system of quality 
control for the audit function of Amtrak OIG in effect for the year ended 
September 30, 2008 has been suitably designed and complied with to provide 
Amtrak OIG with reasonable assurance of performing and reporting in conformity 
with applicable professional standards in ail material respects. Federal audit 
organizations can receive a rating of pass, pass with deficiencies, or fail. Amtrak 
OIG has received a peer review rating of pass with deficiencies. 

We noted two deficiencies during our review. First, Amtrak's quality control 
system requirements need to be followed and all requirements of the quality 
control system need to be made mandatory for projects classified as limited 
scope audits. Second, Amtrak's system for monitoring continuing professional 
education did not ensure that all staff members obtained appropriate CPE credits 
to meet Government Auditing Standards. 



1 . Deficiency - Amtrak OIG needs to ensure that its quality control system is 
followed, particularly in regard to independent report referencing, and Amtrak 
needs to improve its quality control system for projects identified as "limited 
scope audits." Because some elements of the control system designed by 
Amtrak OIG to ensure compliance with Government Auditing Standards were not 
followed, three of the four audits reviewed contained deficiencies that were not 
identified and corrected before the reports were issued. 

a. Amtrak's audit policy, Section 11-14, "Audit Reports," requires an 
independent integrity review of reports. One report with deficiencies was not 
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independently reviewed, while the independent reviews of the two other 
reports with deficiencies were inadequate. Specifically, an analysis of the two 
reports indicated that the independent reviews were not identifying missing 
elements of findings and, in one case, did not identify that sufficient 
supporting evidence was not obtained. Also, the reports for the two audits 
were not fully cross-indexed, thus impeding the independent review process, 

The issue of independent referencing and cross-indexing was previously 
reported in the Letter of Comment from Amtrak's last peer review, which 
stated that cross-referencing and independent review could be improved. In 
response to the recommendation that draft reports and substantive changes 
to final reports be cross-indexed to supporting workpapers and independently 
referenced prior to report issuance, Amtrak Audit issued a reminder to its staff 
to ensure that established procedures were to be followed. 

In response to the current issues with independent referencing, Amtrak audit 
management has stated that it will be revising the Audit Policies to reinforce 
the requirement for independent referencing, with additional instructions for its 
smaller offices where the staff all work on the same audit. They expect the 
revisions to all audit policies to be completed by March 2010. 

b. The control system for audits classified as limited scope audits was not 
properly designed. Amtrak did not mandate that audits classified as limited 
scope audits were subject to all controls established to ensure that all 
applicable Government Auditing Standards were met. Amtrak's Audit 
Manual, Section M-23, "Limited Scope Audits/Consulting Projects," states that 
substantial compliance with Generally Accepted Government Auditing 
Standards (GAGAS) can be achieved for limited scope audits. Section II-23 
allows managers to designate exceptions to the control system when 
conducting limited scope audits, but requires that the exceptions to GAGAS 
be disclosed in the audit report. As a result, audits designated as limited 
scope may not have been subject to all aspects of Amtrak's quality control 
system. However, Government Auditing Standards do not provide for any 
reduction in compliance with standards when auditors represent to others that 
Government Auditing Standards were followed. Government Auditing 
Standards paragraph 1.11 requires that all applicable standards be followed 
when audits are represented as following Government Auditing Standards. 
Further, paragraph 1.12b of the standards discusses using a modified 
GAGAS statement when (1) an audit or attestation engagement is performed 
in accordance with GAGAS except for specific applicable requirements that 
were not followed, or (2) the auditor was unable to and did not perform the 
audit or attestation engagement in accordance with GAGAS because of the 
significance of the departure from the requirements. When using a modified 
GAGAS statement, the auditors are required to disclose in the report the 
requirements not followed, the reasons for not following the requirements, 
and how not following the requirements affected the audit. 
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Two of the four audits reviewed were designated as limited scope audits, 
while the two other audits were ambiguous about whether they were limited 
scope audits. However, all four audits were represented as following 
Government Auditing Standards with no exceptions to government standards 
noted in the reports. By being ambiguous as to whether the audits were 
limited scope, Amtrak runs an additional risk that some full scope audits may 
be incorrectly designated as limited scope in order to bypass the controls that 
ensure compliance with Government Auditing Standards. 

As a result of the weaknesses in Amtrak's control system, deficiencies were 
noted in three of four audits reviewed. One of the audits reported two findings 
that did not have appropriate and sufficient supporting evidence, and two other 
audits reported findings that did not clearly include all elements of findings. In 
addition, one of the three reports also did not rebut management comments that 
disagreed with one finding, which leaves the impression that Amtrak OIG agrees 
with management's position. These deficiencies more likely would have been 
identified and corrected with complete cross-indexing and a more focused 
independent referencing. 

The errors found for each report and the impact the errors had on the reliability of 
the reports are summarized at Attachment 2, which is an integral part of this 
report. 



Recommendations 

The Deputy Inspector General - Audits should: 

Recommendation 1: Enforce all requirements of Amtrak's quality control system 
for all GAGAS audits even if the report contains a modified GAGAS compliance 
statement. 

Recommendation 2: Revise Amtrak's policy on limited scope audits to require 
that all aspects of the quality control system be mandatory for all audits that claim 
to have been conducted in accordance with Government Auditing Standards 
(GAGAS 1.11). 

Recommendation 3; Ensure that a modified GAGAS compliance statement is 
included in the audit report if any applicable standard is not followed, including a 
disclosure of what applicable requirement was not followed, the reason for not 
following the requirement, and how not following the requirement could affect the 
audit (GAGAS 1.12 and 8.30). 
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Amtrak 01 G Response 



Amtrak 01G generally agreed with the finding and recommendations. To ensure 
adherence to 2007 GAGAS a complete overhaul of the Audit Policy Manual is 
underway with complete revision scheduled for March 31, 2010. Mandatory 
training on the revised policies will also be undertaken. Changes to the policies 
would include steps for its smaller offices, such as Boston, to take for 
independent integrity reviews, eliminating the use of "Limited Scope Audits" 
because of the potential for misunderstanding the intent of that policy. The 
revised policies would provide guidance on performing non-audit work and 
services that better encompasses work such as the "Analysis of Overtime 
Wages," which was reported as a GAGAS audit but should have been non- 
GAGAS work. The complete text of Amtrak OIG's comments is at Attachment 3. 



2. Deficiency - Continuing professional education (CPE) was not properly 
monitored to ensure that all staff members obtained appropriate CPE credits to 
meet Government Auditing Standards. As a result, one individual who did not 
satisfy the CPE requirements was allowed to continue to participate on audits for 
over 7 months before obtaining required CPE. This issue was previously 
reported in the Letter of Comment in Amtrak's last external peer review, which 
stated that four auditors did not achieve the minimum continuing professional 
education credits. In response to that report, audit management implemented 
procedures where audit supervisors and headquarters staff in Washington, D.C. 
would be kept informed of courses auditors have taken, headquarters would 
maintain the official record of all courses taken and would notify audit supervisors 
twice in the latter half of each year of the shortfalls that auditors needed to make 
up. These procedures, however, were either not working or not followed. 

A review of CPE credits for 12 of the 37 Amtrak auditors noted that 2 auditors did 
not meet CPE requirements for the 2-year cycle ending December 31 , 2007; two 
auditors were claiming credit for tax courses; and the records maintained in 
Washington, D.C. were incomplete. Of the two auditors who did not meet CPE 
requirements at the end of Amtrak's 2-year cycle ending December 31 , 2007, 
one also did not earn the minimum 20 hours for calendar years 2007 and 2008. 
While one auditor earned sufficient make-up credits within 2 months of the end of 
the 2-year cycle, there was no evidence that the auditor requested or received a 
waiver to make up the deficiency within 2 months of the calendar year end. The 
other auditor did not make up the 2007 year-end shortage until August 2008. 
The auditor was also short of CPE credit for 2008, but had taken sufficient credit 
by the end of February 2009 to make up the shortage. As with the first auditor, 
there was no evidence of requests or approvals to make up the 2007 and 2008 
shortages by the end of February in the following year. Because there were no 
approvals to allow year-end shortages to be made up within 2 months of the year 
end, Amtrak, in accordance with the Government Accountability Office guidance, 
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should not have allowed either auditor to participate in GAGAS audits until the 
shortages were cleared. 

Government Accountability Office guidance allows supervisors to approve 
waivers through February of the following year. As a practical matter, the 
waivers probably would have been approved had they been requested. 
However, the absence of request and approval highlights the lack of supervisory 
oversight in Washington, D.C., where CPE monitoring was supposed to be 
conducted. Further, discussions with the two auditors showed that they were not 
carefully tracking their own CPE credits, and the supervisor was not tracking the 
CPE credits of his staff. The Deputy Inspector General - Audits, acknowledged 
that he was not monitoring the CPE progress of his staff, but was relying on an 
administrative assistant to maintain a CPE record for each auditor and report 
deficiencies to him. The administrative assistant currently responsible for 
tracking CPE credits was assigned to the task after the deficiencies identified 
above had occurred. Discussions with the administrative assistant also indicated 
uncertainty as to what CPE records to keep, what information should be reported 
and when it should be reported. 

In addition, the system tracking CPE credits did not identify which courses 
satisfied GAGAS CPE requirements and which did not. Two auditors submitted 
certificates for state and Federal tax courses to Washington, D.C. for CPE credit. 
Guidance from the Government Accountability Office clearly states that tax 
courses are not creditable unless they're applicable to the subject matter of an 
audit. Since Amtrak does not audit taxes, we believe tax courses are not 
appropriate training for Amtrak auditors to receive CPE credit under Government 
Auditing Standards. The auditors taking these courses had sufficient other CPE 
credits during the period to meet Government Auditing Standards requirements 
for the 2-year cycle ending December 31, 2007. However, these auditors could 
end up with a deficiency for the 2-year period ending December 31 , 2009, if they 
are inappropriately counting these tax courses as creditable CPE under 
Government Auditing Standards. 

The review noted that the CPE records maintained in Washington, D.C. were 
incomplete. Certificates were not available for all courses Amtrak auditors 
claimed as taken. The Washington, D.C. records also did not agree with the 
training listed on a qualifications statement that each auditor prepares prior to 
participating in an audit. In addition, some of the certificates submitted were not 
clear as to the number of CPE hours claimed or the formula for converting non- 
hour credits into CPE hours. 

A strong system to track CPE helps ensure that auditors are obtaining the 
required CPE credits and assists supervisors in identifying and providing 
appropriate training to staff. 
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Recommendation 4; The Deputy Inspector General - Audits should design and 
implement a system that accurately tracks required CPE credits. The system 
should at a minimum ensure that: 

• auditors timely submit a copy of all training certificates to the administrative 
assistant in Washington, D.C. who is responsible for CPE recordkeeping, 

• the administrative assistant responsible for CPE recordkeeping maintains a 
file of all certificates and a record for each auditor that lists the name of each 
course taken, the date it was taken, the name of the training provider, and the 
CPE hours credited on the certificate. 

• extension requests and approvals for not obtaining sufficient CPE by the end 
of a calendar year and 2-year cycle are documented, with a copy maintained 
by the auditor, supervisor and administrative assistant responsible for CPE 
recordkeeping 

• CPE hours used to make up shortages in a prior year are credited only to that 
prior year and not also credited in the year in which the CPE hours were 
taken. 

• all courses taken for credit are allowable as defined by the Government 
Accountability Office. 

Amtrak OIG Response 

Amtrak OIG generally agreed with the finding and recommendation. While 
Amtrak OIG stated that it was substantially in compliance with continuing 
professional education requirements, the Deputy Inspector General - Audits has 
made revisions to the posting and tracking of CPE. The complete text of Amtrak 
OIG's comments is at Attachment 3. 

LSC OIG Analysis of Responses 

Amtrak OIG's planned actions as noted above are responsive to our review's 
observations and recommendations and, if properly implemented, should 
address all maters raised during this peer review. In response to the 
recommendation to improve compliance with CPE requirements, Amtrak OIG 
reemphastzed the GAGAS requirements to obtain 80 hours of CPE over 2 years. 
While the written response does not specifically address the process of 
requesting and approving extensions to the timeframe for obtaining CPE credits, 
management officials did state that the new policies will include such 
requirements. We are encouraged that the Amtrak OIG has completed or 
intends to complete all actions on our recommendations by March 31 , 2010. 

Attachment 3 to this report includes Amtrak OIG's full response to the above 
deficiencies. The "...attached correspondence..." referenced in Amtrak OIG's 
comments was not provided with the comments and thus are not included with 
the attachment. 
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As is customary, we have issued a letter dated September 30, 2009, that sets 
forth findings related to the design of and compliance with Amtrak OIG's system 
of quality control that were not considered to be of sufficient significance to affect 
our opinion expressed in this report. Amtrak OiG's response to that letter is 
included as an attachment to the letter. 



Sincerely, 




Enclosure 



8 



Attachment 1 



SCOPE AND METHODOLOGY 

We tested compliance with the Atntrak OlG's system of quality control to the 
extent we considered appropriate. These tests included a review of 4 of 27 audit 
reports issued during the period October 1 , 2007, through September 30, 2008, 
and semiannual reporting for the period April 1, 2006, through September 30, 
2008. We also reviewed the internal quality control reviews performed by Amtrak 
OIG. 

Our review was conducted at the Amtrak OlG's Office of Audit in Washington, 
D.C. 

Reviewed Audits Performed by Amtrak OIG 

Report No. Report Date Report Title 

301- 2007 5-22-08 Amtrak Leasing Practices 

302- 2008 9-30-08 Boston Station Audit 
403-2008 5-28-08 Fuel Supply - Gas City Contract 
1 05-2007 1 -09-07 Analysis of Overtime Wage 
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Attachment 2 

RESULTS of REVIEWS 

a. Findings Lack Appropriate and Sufficient Evidence and Do Not Include 
All Elements of a Finding. 

Report No. 301-2007. Leasing Practices Audit (June 11. 2008) 

Of the four findings in the report, two did not have appropriate and sufficient 
evidence. In addition, these two findings and another finding did not have all 
elements of a finding. 

• Finding 4 stated in its entirety that "A review of a sample of leases and 
discussions with Real Estate personnel indicated that Amtrak lease contracts 
do not mandate security background screenings for tenants and their 
employees." The only supporting document referenced was an email 
response from Amtrak management which states in part, "Thanks for 
including us in your thinking on finalizing recommendations." There was no 
cross-indexing to documents that identify criteria related to requiring 
background checks. There was no cross-indexing to the sample of leases 
that do not have a background screening requirement. The only documented 
reference was to the email from management. This finding was solely about 
a potentially adverse condition and was missing criteria, cause and effect. 

• Finding 3 stated that the auditors wanted to determine if the current practice 
of including utility expenses in the square foot price of leased space protected 
Amtrak against extra-ordinary utility increases. The finding noted that typical 
Amtrak leases contain a general escalation clause rather than a specific utility 
escalation clause. The finding then proceeded to mention an interview with a 
senior manager who indicated that a utilities escalation clause could become 
part of future leases. However, there was no analysis of whether the current 
lease provisions do or do not provide adequate protection against extra- 
ordinary increases. This finding also was only about a potentially adverse 
condition and was missing criteria, cause and effect. 

The initial draft was significantly rewritten and did not include finding 3. The 
initial draft also was the only version of the report that was cross-indexed and 
then only partially. Amtrak's Audit Manual, Section II-9, "Workpapers," states 
that complete and accurate cross-indexing 2 in the workpaper file is an 
essential component of completing the work of the audit, and as a minimum, 
revisions to draft reports should be indexed to the supporting workpapers. 
However, the policy allows supervisors to exempt limited scope audits 



2 Amtrak's policy uses the word "referencing" where we use "cross-indexing" to mean the same thing and 
to differentiate from the use of "independent referencing." 
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workpapers and reports from complete cross-indexing and independent 
referencing. 



We also noted that the draft report sent to management, which typically 
solicits management's formal comments, already included management's 
comments. While management subsequently returned the draft with their 
edits, there was no cross-indexing to supporting documentation that shows all 
comments identified as management's are in fact management's. Based on 
the edits, though, management did not object to what was written as their 
position. 

• Finding 2 discussed that Amtrak leases do not always include floor plans 
detailing the space leased and cites the one instance found where the lessee 
was occupying more space than the lease authorized. The report properly 
stated that lessees should not occupy more space than the lease allows, but 
it did not discuss how the lessee ended up occupying more square footage 
than the lease allowed. The report recommended providing station managers 
with detailed floor plans, but that only partially addresses the problem of 
lessees occupying unauthorized space. Reviews of build-out plans and 
taking measurements during and after build-out are other preventive 
measures that would complement detailed drawings to ensure lease 
requirements are followed. Regardless, even these additional measures may 
not fully address the cause of the problem because the report did not discuss 
why the lessee had more space than authorized. 

The following two reports had findings that did not clearly identify all elements of 
a finding, particularly cause. The primary concern is that recommendations for 
corrective action should be directed at addressing the cause of the reported 
problem. The Government Auditing Standards paragraph 8.28 states in part, 
"Auditors should make recommendations that flow logically from the findings and 
conclusions, are directed at resolving the cause of identified problems and clearly 
state the actions recommended." Further, Amtrak's Audit Manual, Section 11-1 1 , 
Finding Sheets, states that failure to identify causes is extremely critical and may 
result in recommendations that are unlikely to prevent future occurrences. 

Report No. 302-2008, Boston Station Audit (September 30. 2008) 

Of the six findings, three did not have all elements of a finding. 

• Finding 1 did not have cause or effect. The finding discussed manually 
issuing out-of-sequence tickets, missing tickets and poor record keeping, but 
it did not discuss the cause or adverse effect of these conditions. This finding 
may be a compliance issue which might mitigate the need to elaborate on the 
effect of not following a policy, but the cause of not following the policy is 
important especially when recommending effective corrective action, such as 
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recognizing that a policy is ineffective and needs reconsideration to address 
changed circumstances. 

• Finding 3 also did not have cause or effect. The finding was about spending 
station funds for inappropriate purposes, but does not discuss the cause of 
inappropriate spending. The recommendation was to spend oniy on 
approved items, Without knowing the cause, the recommendation may not 
cure the issue, and there may have been a need to also recommend recovery 
of inappropriately spent funds or sanction those engaging in inappropriate 
spending, 

• Finding 5 did not discuss why die stamps were not recorded on cancelled 
tickets. Again, the recommendation that die stamps be used may not 
properly resolve the cause. 

It should also be noted that the above findings did not identify the magnitude of 
the problems. For example, the findings did not identify the number of tickets 
issued out of sequence, the amount of inappropriate spending, and how many 
die stamps were not recorded. This information is helpful in establishing 
materiality. These findings may be compliance issues where any non- 
compliance could be considered a reportable issue to be corrected. Even so, 
identifying the magnitude of the adverse conditions can be important information 
to those who need to implement corrective actions. Government Auditing 
Standards, paragraph 8.16, states the auditors should place findings in 
perspective, it also states that auditors should relate the instances identified to 
the population or the number of cases examined and quantify the results in terms 
of dollar value, or other appropriate measures. 

Report No. 105-2007. Analysis of Overtime Wages (January 8. 2008) 

This report was more of a statistical compilation of overtime usage than an 
analysis designed to help management identify instances of fraud, waste and 
abuse as the purpose the audit report was described. There were nine points 
discussed in the report and basically they describe how many employees made 
over $100,000 in regular and overtime wages, what job description were involved 
in most of the overtime, the locales where the overtime was earned, and other 
similar statistical information. There were no clearly stated deficiencies related to 
the statistics presented other than it's a lot of overtime and that the statistics are 
similar to an earlier audit report. As to cause, the report recommended that 
management determine the root cause and report back to the Office of Inspector 
General with an action plan to address the problem. Also, there were no 
management comments included in the report. 

Amtrak audit management stated that reviews similar to this one are occasionally 
undertaken as an advisory management assignment and are not intended to be 
an audit. They then stated that this audit should not have been presented as an 



12 



audit complying with GAGAS, but as a non-audit assignment where the issues 
were meant to be presented as observations not as findings. Further, they stated 
that their policy revisions would include guidance on communicating and 
reporting on observations in non-audit assignments. 

b. No Rebuttal to Management's Comments That Disagreed With a Finding 

Finding 6 of the Boston Station audit report (302-2008) did not rebut 
management's comments which disagreed with the audit finding on the issue of 
excess assigned working funds. Government Auditing Standards paragraph 8.36 
states in part, "if the auditors disagree with the comments, they should explain in 
the report their reasons for disagreement. Conversely, the auditors should 
modify their report as necessary if they find the comments valid and supported 
with sufficient, appropriate evidence." By not rebutting management's refusal to 
reduce assigned working funds, readers likely would assume that the OIG was 
accepting Amtrak management's position. If that was truly the case then this 
finding probably should not have been included in the final report. 

c. Designation As Limited Scope Audit May Allow Shortcuts To Proper 
Audit Oversight 

The audit policy on Limited Scope audits allows shortcuts to proper audit 
oversight. The Leasing Practices audit and the Boston Station audit were 
ambiguous as to whether they come under the Limited Scope Audit designation. 
Neither were quick response audits, taking over 17 months and 3 months, 
respectively, to complete. The audit policy suggests that limited scope audits 
take little time to complete such as 3 to 5 days. The initial audit program of the 
Leasing Practices audit stated that it's the successor to another audit which was 
cancelled in favor of expanding the scope of the audit to encompass a review of 
Amtrak's leasing practices. The Boston Station audit appeared to be a routine 
audit based on a standardized audit program. Neither audit was requested by 
Amtrak management which is a primary reason for conducting limited scope 
audits, although Audit Managers as an exception may elect to conduct a limited 
scope audits. Neither of these audits was identified in the audit assignment 
memoranda as limited scope. However, internal review documents prepared at 
the end of each audit indicated that each was a limited scope audit. An 
exception's memorandum in Leasing Practices audit cited limited scope as one 
of the justifications for not following Amtrak standards. The Workpaper Review 
Checklist for the Boston Station Audit cited limited scope as a reason for not 
following Amtrak standards. We believe the limited scope designation may be 
used to reduce the cross-indexing and independent referencing required of 
normal audits. 

The auditors cited another reason for not conducting independent referencing. 
They stated that they do not conduct independent referencing because they all 
work on the same audits so there was no one in their office who was 
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independent. While it is true that this office cannot and should not conduct 
independent reviews of its work, their argument does not recognize that all 
Amtrak audits are recorded into an electronic audit data management system 
and audit documentation can be made available to anyone approved to access 
the data. As an example, auditors in Los Angeles can review the workpapers of 
audits done by the Boston office, 
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Attachment 3 



AMTRAK OIG COMMENTS 
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AMTRAK 




September 4, 2009 



Legal Services Corporation 

Office of Inspector General 

Attn: Jeffrey E. Schanz, Inspector General 

3333 K Street, NW 

3 rd Floor 

Washington, DC 20007 

Subject: Response to Report on External Quality Control Review of the National 
Passenger Railroad Corporation Inspector General Audit Organization 

Dear Mr. Schanz: 

Below is our written response to the official draft peer review report dated September 13, 
2009. 

Peer Review Report 

Thank you for the opportunity to respond to the official draft of the peer review report. 
Also, thanks again for doing the review, which had not been scheduled. Overall, the 
report gives us a "pass with deficiencies" and provides findings and recommendations 
that will enable us to improve our audit process quality control system. Overall, we are 
aware of the need to update our "Audit Procedures Manual" (APM) and started to update 
it in November 2008 and anticipate a completion date of March 3 1 ,201 0. Furthermore, 
our plan is to provide the revised APM to all the audit staff and provide training on the 
revised manual to ensure all audits are preformed in compliance with the 2007 Generally 
Accepted Government auditing Standards (GAGAS) and that all the policies and 
procedures governing our audits are understood and adhered with. The following are 
specific comments for the findings and recommendations: 

Finding and Recommendations 1 

Amtrak OIG needs to ensure its quality control system is followed, particularly in regard 
to independent report referencing, and Amtrak needs to improve its quality control 
system for projects identifies as "limited scope audits". The report stated that three of 
the four audits reviewed contained deficiencies that were not identified and corrected 
before the reports were issued. The report recommended that the Deputy Inspector 
General - Audit (J) enforce all requirements of Amtrak's quality control system for all 
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GAGAS audits even if l he report contains a modified GAGAS compliance statement, 
(2)revise Atntrak 's policy on limited scope audits to require that all aspects of the its 
quality control system be mandatory for all audits that claim to have been conducted in 
accordance with GAGAS, and (3) ensure that a modified GAGAS compliance statement 
be included in the audit report if any applicable standard is not followed, including a 
disclosure of what applicable requirement was not followed, the reason for not following 
the requirement, and how not following the requirement could affect the audit. 

We generally agree with the finding and the three recommendations. To enhance the 
independent integrity review process of audit reports we plan to revise the APM to 
reinforce the requirement and add additional internal controls to ensure GAGAS 
standards were adhered with. The revised APM will also include guidance on steps to 
take for independent integrity reviews for our smaller audit offices (Boston has a staff of 
three) where the entire staff may work on the audit and report, which was the case with 
two of the audits selected for review (301-2007 "Amtrak Leasing Practices" and 302- 
2008 "Boston Station Audit"). 

The use of "limited scope audits" will be eliminated in the revised APM. We were aware 
of the potential for misunderstanding and use of "limited scope audits" (Section 11-23, 
"limited Scope Audits/Consulting Projects") prior to the peer review and planned to 
remove the term from our revised APM. Our use of "limited scope audits" was intended 
lo be used to cover all types of audit reports that may not have been in performed in full 
compliance with GAGAS. Specifically, certain reviews were undertaken as an advisory 
assignment and were not intended to be an audit, which was the case with the report 
"Analysis of Overtime Wages" 105-2007, selected for the review, We agree that this 
report should not have been represented as a GAGAS audit, but rather as a non-audit 
assignment. The revised APM will address and provide guidance on the performance of 
non-audit work and reporting. In addition, the statement that reports findings that did not 
include all the elements (condition, criteria, cause and effect) of a finding was due to the 
intent to disclose the situation and present our observation rather than a finding. Guidance 
on communication and/or reporting on observations will also be addressed in the revised 
APM. 

As previously stated, when the APM is revised and updated in 2010 we plan to distribute 
it to all staff and conduct mandatory training to ensure all Amtrak's audit staff understand 
the guidance on report adequacy, indexing, and independent referencing. 

The Deputy Inspector General ™ Audits has tasked Alan Klein, Senior Director, Audits, 
Washington DC, to be responsible for updating our APM. It will include improvements 
for independent integrity reviews with requisite internal controls and eliminating the use 
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of audit performed as "limited scope" audits, as well as a complete overhaul of the APM 
to ensure it is aligned with the 2007 GAGAS, Our implementation date for the revised 
APM is March 31, 2010, however the revising of the manual is currently in progress and 
as sections are completed they will implemented. 

Finding and Recommendations 2 

Continuing Education was not properly monitored to ensure that all staff members 
obtained appropriate CPE credits to meet Government Auditing Standards. As a result 
one individual who did not satisfy the CPE requirements was allowed to continue to 
participate on audit over 7 months before obtaining the required CPE. The report 
recommends that the Deputy Inspector General - Audit design and implement a system 
that tracks required CPE credits. The system should at a minimum ensure that: auditors 
timely submit a copy of all training certificates to the administrative assistant in 
Washington, D.C. who is responsible for CPE recordkeeping; the administrative 
assistant responsible for CPE recordkeeping maintains a Jile of all certificates and a 
record for each auditor that lists the name of each course taken, the date it was taken, the 
name of the training provider, and the CPE hours credited on the certificate; extension 
requests and approvals for not obtaining sufficient CPE by the end of a calendar year 
and 2-year cycle are documented with a copy maintained by the auditor, supervisor and 
administrative assistant responsible for CPE recordkeeping; CPE hours used to make up 
shortages in a prior year are credited only to that prior year and not also credited in the 
year in which the CPE hours were taken; and all courses taken for credit are allowable 
as defined by the Government Accountability Office. 

We generally agree with the finding and recommendation, however, it should be noted 
that we were substantially in compliance with the CPE guidance. Nonetheless, during the 
peer review when the issue of non compliance with our CPE guidance was brought to our 
attention, the Deputy Inspector General- Audits took immediate action and revised the 
guidance to strengthen the internal controls and ensure there is no deviation from the 
guidance. 

The Deputy Inspector General - Audits Washington DC, is responsible for ensuring all 
audit staff are in compliance wiih the CPE requirements (see attached for correspondence 
to the Amtrak audit staff). The Deputy Inspector General- Audits made revisions to the 
posting and tracking of CPE and we consider this recommendation implemented, 



Sincerely, 




Lorraine A. Green 
Interim Inspector General 
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Inspector General 

Jeffrey E. Schanz 



September 30, 2009 

Ms. Lorraine A. Green 

interim Inspector General 

Office of inspector General 

National Passenger Railroad Corporation 

10 G Street, NE 

Washington, D.C, 20002 

Dear Ms. Green: 

We have reviewed the system of quality control for the audit function of Amtrak 
OIG in effect for the year ended September 30, 2008, and have issued our report 
thereon dated September 30, 2009, in which the Amtrak OIG received a rating of 
pass with deficiencies. That report should be read in conjunction with the 
comments in this letter, which were considered in determining our opinion. The 
findings described below were not considered to be of sufficient significance to 
affect the opinion expressed in that report. 

Finding 1. Peer Reviews Need to be Scheduled Timely, Provided to 
Appropriate Oversight Bodies and Made Publicly Available 

The Deputy Inspector General - Audits did not realize until November 2008 that 
an external peer review of the Office of Audit had not been scheduled and was 
significantly overdue by several months. The peer review should have been 
scheduled so that a report would have been issued by December 31, 2007. 
Government Auditing Standards and peer review guidance 3 require an external 
peer review be obtained every 3 years and a report issued within 9 months of 
that date. In Amtrak's case, a peer review should have been scheduled for the 3- 
year period ending March 31, 2007 with a report issued by December 31, 2007. 
In his February 24, 2009 request for an extension of its peer review cycle from 
March 31, 2007 to September 30, 2008, Amtrak's former Inspector General 
noted that Amtrak had been inadvertently left off the schedule of reviews and that 
Amtrak did not catch the exclusion. On March 30, 2009, the Council of the 



3 The Council of the Inspectors General on Integrity and Efficiency administers the external peer review 
program under GAGAS for Federal Offices and publishes the Guide for Conducting External Peer Reviews 
of Audit Organizations of Offices of Inspector General. The guide elaborates on the Government Auditing 
Standards ' external peer review timing requirements. 
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Inspectors General on Integrity and Efficiency with concurrence from the 
Government Accountability Office approved a one-time-only adjustment to 
Amtrak's peer review cycle. 

As for communicating its peer review results, Amtrak's DIGA stated that they 
have not communicated the overall results and the availability of those past 
reviews to appropriate oversight bodies, nor made them publicly available. 
Government Auditing Standards and peer review guidance 4 require internal audit 
organizations to communicate the overall results and the availability of the 
external peer review to appropriate oversight bodies and to make the report 
publicly available. 

Recommendation: The Deputy Inspector General - Audits should (a) ensure 
that peer reviews of its audit activities are scheduled in accordance with 
Government Auditing Standards and peer review guidance; and (b) communicate 
the overall results and the availability of the external peer review to appropriate 
oversight bodies; and (c) make the report publicly available 

Amtrak OIG Response 

Amtrak OIG concurred with the recommendation, but believes that extenuating 
circumstances led to its delay in obtaining a timely peer review. Amtrak OiG 
indicated that Amtrak OIG and CIGIE (formally PCIE/ECIE) should mutually 
share the responsibility for the delay in Amtrak obtaining a peer review, citing the 
combination of not being scheduled for a review and the retirement of its Senior 
Director who was responsible for ensuring a timely review as keys to the delay in 
obtaining a review. Amtrak OIG goes on to state that the replacement Senior 
Director subsequently realized the delay had occurred which led to the 
scheduling of the peer review 

Finding 2. Update Policies and Procedures 

Amtrak policies and procedures were significantly out-of-date and do not fully 
incorporate the latest Government Auditing Standards. Also, the Office of Audit's 
current use of automated workpapers was not incorporated in its policies and 
procedures. 

• The four audit reports reviewed included the statement about following 
Generally Accepted Government Auditing Standards (GAGAS) from the 
2003 edition of Government Auditing Standards, when they should have 
cited from the 2007 edition. The Deputy Assistant Inspector General - 
Audits subsequently issued a memorandum directing the audit staff to 
incorporate the current GAGAS statement in future reports. 



4 The Guide for Conducting External Peer Reviews of Audit Organizations of Offices of Inspector General 
elaborates on the Government Auditing Standards' external peer review reporting requirements. 
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• Many of Amtrak's policies and procedures were issued in the 1 990s and 
referenced Government Auditing Standards from that period. 

• Amtrak's Policies and Procedures do not include attestation agreements. 

• Amtrak's policies and procedures emphasize paper processes, yet the 
auditors have been using automated workpapers since iate in 2006. 

The DIGA agreed that revisions and updates were needed and noted that some 
revisions have already been tasked to specific auditors. 

Recommendation: The Deputy Inspector General - Audits should ensure that 
revisions to the audit manual are completed timely, and reflect current 
Government Auditing Standards and Amtrak's use of automated workpapers. 

Amtrak OIG Response 

Amtrak OIG concurred with the recommendation and stated, "As mentioned at 
the onset of the peer review, we were in the process of revising the APM prior to 
the peer review. Assignments have been made in connection with this effort to 
revise the APM and it is scheduled to be completed no later than March 2010." 

LSC OIG Analysis of Responses 

Amtrak OIG's actions taken and planned are responsive to our findings and 
recommendations and should address ail matters raised, in regard to the 
timeliness of the peer review, Amtrak OIG is ultimately responsible for ensuring 
that it receives a peer review within the allowable timeframe (Government 
Auditing Standards, paragraph 3.56). CIGIE helps manage the peer review 
process throughout the IG community by providing a schedule for al! IGs to 
follow. However, this service does not relieve an organization of the 
responsibility to obtain a peer review within the timeframe prescribed by 
standards. The complete text of Amtrak OIG's comments is at Attachment 1 . 



Sincerely, 




jeffrey/E. Schanz" 
Inspector General 



Enclosure 
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Attachment 1 



AMTRAK OIG RESPONSE 
to the 

LETTER OF COMMENT 



Letter of Comment 

Finding L Peer reviews need to be scheduled timely, provided to appropriate oversight 
bodies, and made publicly available. The report recommended that the Deputy Inspector 
General for Audit shoidd (a) ensure that the next peer review of its audit activities is 
scheduled in accordance with Government Auditing Standards and peer review 
guidance; (b) communicate the overall results and the availability of the external peer 
review to appropriate oversight bodies; and (c) make the report publicly available, 

The failure to have our peer review done timely was a mutual PCIE/ECIE and Amtrak 
OIG oversight. The PCIE/ECIE didn't include us on their schedule and we didn't detect 
the oversight. Also, the Senior Director - Audits Washington DC whose responsibility 
was to monitor this requirement retired early in 2008 and his replacement didn't arrive 
until late June 2008. The Senior Director - Audits Washington, DC did detect the 
oversight and action was taken immediately to correct the oversight. Nonetheless we 
concur with the recommendation. 

Finding 2. Amtrak policies and procedures were significantly out-of-date and do not 
fully incorporate the latest Government Auditing Standards. Also, the Office of Audit's 
current use of automated workpapers was not incorporated in its policies and 
procedures. 

The report recommended that the Deputy Inspector General - Audits ensure that revisions 
to the audit manual are completed timely, and reflect current Government Auditing 
Standard and Amtrak's use of automated workpapers. 

As mentioned at the onset of the peer review, we were in the process of revising the APM 
prior to the peer review. Assignments have been made in connection with this effort to 
revise the APM and it is scheduled to be completed no later than March, 201 0. 



Sincerely, 




Lorraine A. Green 
Interim Inspector General 
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